Skip to content
OpenAdvisories
Critical USN-9060-1 1 CVE

ruby-kramdown vulnerability

Published Nov 11, 2026 · Updated Nov 12, 2026

Ecosystem: Ubuntu

Summary

It was discovered that kramdown processed the template option in documents
by default. An attacker could possibly use this issue to read arbitrary
files or execute arbitrary code.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS ruby-kramdown 1.10.0-1ubuntu0.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS ruby-kramdown 1.15.0-1ubuntu0.1~esm1

Vulnerabilities 1

  • Critical 9.8
    CVE-2020-14001

    Unintended read access in kramdown gem

    The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with templ…

    icinga2 ruby-kramdown kramdown ruby-kramdown Debian Ubuntu Alpine RubyGems

References

  • report
    https://ubuntu.com/security/CVE-2020-14001